[OAUTH-WG] Re: WG Last Call: draft-ietf-oauth-rfc8725bis-02 (Ends 2025-12-15)

[Michael Jones <[e-mail]>]

Dear OAuth Chairs and Working Group,

The editors have updated the draft in https://www.ietf.org/archive/id/draft-ietf-oauth-rfc8725bis-03.html to incorporate the last call feedback received.  Specifically, we have added a note about the compatibility problems that can be caused by retroactively retrofitting mandatory explicit typing where there was none.  And we have added an informative reference to draft-ietf-jose-deprecate-none-rsa15.

We believe that the next step is to obtain a shepherd review and then request publication.

                                                                Thanks,
                                                                -- Mike (for the editors)

From: Yaron Sheffer <[e-mail]>
Sent: Monday, December 1, 2025 7:51 AM
To: Michael Jones <[e-mail]>; Rifaat Shekh-Yusef <[e-mail]>; [e-mail]; [e-mail]; [e-mail]
Subject: Re: [OAUTH-WG] Re: WG Last Call: draft-ietf-oauth-rfc8725bis-02 (Ends 2025-12-15)

Joining my co-author, I believe the draft is ready for publication.

Thanks,
      Yaron

On 01/12/2025, 17:35, "Michael Jones" <[e-mail]<mailto:[e-mail]>> wrote:
Unsurprisingly, as an author of the draft, having described all the new mitigations to issues that have come to light since the original JWT BCP was published as additional JWT best current practices, while retaining all of those already published in RFC 8725, I believe it is ready for publication.

                                Thanks all,
                                -- Mike

-----Original Message-----
From: Rifaat Shekh-Yusef via Datatracker <[e-mail]<mailto:[e-mail]>>
Sent: Monday, December 1, 2025 5:46 AM
To: [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>; [e-mail]<mailto:[e-mail]>
Subject: WG Last Call: draft-ietf-oauth-rfc8725bis-02 (Ends 2025-12-15)


Subject: WG Last Call: draft-ietf-oauth-rfc8725bis-02 (Ends 2025-12-15)

This message starts a 2-week WG Last Call for this document.

Abstract:
   JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security
   tokens that contain a set of claims that can be signed and/or
   encrypted.  JWTs are being widely used and deployed as a simple
   security token format in numerous protocols and applications, both in
   the area of digital identity and in other application areas.  This
   Best Current Practices (BCP) specification updates RFC 7519 to
   provide actionable guidance leading to secure implementation and
   deployment of JWTs.

   This BCP specification furthermore replaces the existing JWT BCP
   specification RFC 8725 to provide additional actionable guidance
   covering threats and attacks that have been discovered since RFC 8725
   was published.

File can be retrieved from:
https://datatracker.ietf.org/doc/draft-ietf-oauth-rfc8725bis/

Please review and indicate your support or objection to proceed with the publication of this document by replying to this email keeping [e-mail]<mailto:[e-mail]> in copy. Objections should be motivated and suggestions to resolve them are highly appreciated.

Authors, and WG participants in general, are reminded again of the Intellectual Property Rights (IPR) disclosure obligations described in BCP 79 [1]. Appropriate IPR disclosures required for full conformance with the provisions of BCP 78 [1] and BCP 79 [2] must be filed, if you are aware of any. Sanctions available for application to violators of IETF IPR Policy can be found at [3].

Thank you.

[1] https://datatracker.ietf.org/doc/bcp78/
[2] https://datatracker.ietf.org/doc/bcp79/
[3] https://datatracker.ietf.org/doc/rfc6701/